Hi there! I have a strange problem I tryied to googled but could not found solution so far. Here my context: I imported IAM User and Group. As I'm at the import step the first time I run pulumi it raise error as I may don't have the correct policy to make the action, so first time it fail then I update my policy, run it again and my data are imported correctly. So first I go with User and on first call it fail as I did not have "iam:GetUser" so I add it and then run again and no problem my users are imported. 🎉 Next I import Group and same as user it fail so I add "iam:GetGroup" and run again but here it became weird I have error message asking to update the name of my group to append a random string, then always fail. My problem: Each time I run "pulumi up" pulumi tell me that I have update for the group (I have a total of 4 groups) 4 times something like: ~ awsiam/groupGroup: (update) 🔒 ..... ~ name: "app-e7195e2" => "app-2482515 If I say yes it fail as the app-e7195e2 group don't exist. The real name when I first import was "app" and did not change. And each time I have a different random string after name of the group... If somebody have an idea or suggestion to solve this case, It will be very helpful. Thank for any help.

The name change is happening because Pulumi thinks you're creating a new resource (IAM group) instead of using the one you just imported. There's a few reasons this might be happening. I think the most likely is that your initial attempt to import the group added Pulumi code for you, but didn't add it to your Pulumi state. You need to resolve this: get the state and code to match up.

After posting I found one stackoverflow question and notice that I don't force the name in the group definition So I update the call to:

aws.iam.Group(

"app",

name="app",

pts=pulumi.ResourceOptions(protect=True)

)

But still have the same problem now pulumi want to change the name from app-random to "app" but app-random don't exist.

You'll need to check what's in code, state and AWS, and figure out which one has to change to make everything line up.

Thanks for the fast reply.... I will try your suggestion and post back here.

Your latest comment makes me think that the group is imported into state already. So you may want to update the state to be correct, rather than get Pulumi to change AWS, which is what it is trying to do.

Thank again, I will check how to update the state. Sorry for the not clear question I'm still beginner here, I learn every day.

That's fine, we've all been there, and Pulumi is built on some complex ideas. Fortunately it's mostly the same ideas over and over, so once you get used to it, you can solve most problems really quickly.

Cool, thanks for the help, I was able to export edit and import, I no more have diff with the group name! 🎉 I found the doc about state and command example on how to import/export. It's pretty simple, I will read again the doc to learn more about. Thank a lot for the help. 🙇 https://www.pulumi.com/docs/intro/concepts/state/#migrating-between-backends